GitHub Advisoryadvisory · npm

GHSA-jg8r-5jh2-v2xj Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

MEDIUM Published 2026-06-26 Modified 2026-09-04 Official page ↗

Aliases: CVE-2026-11779
Ecosystem: npm
Packages: payload
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-307
Reviewed: 2026-09-04

Affected packages

• npm payload: <= 3.88.0 (no fix yet)

Description

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

Related

Alias · CVE (1)

CVE-2026-11779 An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock… vulnerability

Weakness · CWE (1)

CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References